{"action":"Upgrade redaxo/source to 5.21.1 or later.","affected":[{"fixed":"5.21.1","introduced":"5.18.2"}],"component":"redaxo/source","cve_ids":["CVE-2026-53599"],"ecosystem":"Packagist","epss":0.00508,"exploited":false,"fixed_versions":["5.21.1"],"ghsa_id":"GHSA-98pp-vccm-qm25","id":"tcs_01M5KEZVB93XVZV589Y571EV2T","modified_at":"2026-07-31T20:11:44.529758Z","published_at":"2026-07-31T19:43:51Z","references":["https://osv.dev/vulnerability/GHSA-98pp-vccm-qm25","https://github.com/redaxo/core/security/advisories/GHSA-98pp-vccm-qm25","https://github.com/redaxo/core/pull/6538","https://github.com/redaxo/core/commit/462e36896bb65d292ba22d711044c23c9cfb0340","https://github.com/redaxo/core","https://github.com/redaxo/core/releases/tag/5.21.1"],"severity":{"label":"high","score":7.5},"sources":[{"source":"osv","source_id":"GHSA-98pp-vccm-qm25","url":"https://osv.dev/vulnerability/GHSA-98pp-vccm-qm25"}],"summary":"Redaxo has a Mediapool isAllowedExtension bypass via multi-segment filename that leads to authenticated RCE on Apache mod_php multi-extension handlers"}